expand checkSignature with more params for checking addresses

[jinglescode]

Is your feature request related to a problem? Please describe.

See:

• 345

• 346

• https://github.com/cardano-foundation/cardano-verify-datasignature

Describe the solution you'd like

Expand the capability of checking signature like CF solution

const key =
  'a4010103272006215820b89526fd6bf4ba737c55ea90670d16a27f8de6cc1982349b3b676705a2f420c6';
const signature =
  '84582aa201276761646472657373581de118987c1612069d4080a0eb247820cb987fea81bddeaafdd41f996281a166686173686564f458264175677573746120416461204b696e672c20436f756e74657373206f66204c6f76656c61636558401712458b19f606b322982f6290c78529a235b56c0f1cec4f24b12a8660b40cd37f4c5440a465754089c462ed4b0d613bffaee3d1833516569fda4852f42a4a0f';
const message = 'Augusta Ada King, Countess of Lovelace';
const address = 'stake1uyvfslqkzgrf6syq5r4jg7pqewv8l65phh024lw5r7vk9qgznhyty';

console.log(verifyDataSignature(signature, key)); // true
console.log(verifyDataSignature(signature, key, message)); // true
console.log(verifyDataSignature(signature, key, message, address)); // true
console.log(
  verifyDataSignature(
    signature,
    key,
    message,
    'stake1_test1hweafkafrwf9ets85rs9gtk9qgzegwtg'
  )
); // false
console.log(
  verifyDataSignature(signature, key, 'Augusta Ada King, Countess of Lovelace!')
); // false

• to do without breaking change?
• if breaking changes is needed, push for in v2.0

[JustLeif]

I briefly attempted to try to implement this, using the documentation here https://developers.cardano.org/docs/integrate-cardano/user-wallet-authentication/. From my perspective, the API should look like this if we don't want breaking changes.

export const checkSignature(
   data: string,
   { key, signature }: DataSignature,
   address?: string
) => { ... }

Another helper function we probably need (I didn't see it in the libraries CoseSign1 implementation), is an equal of the:

CoseSign1.headers().protected().deserialized_headers()

Found in the @emurgo/cardano-message-signing-nodejs package. (I noticed that library was not a dependency of the MeshSDK).

I imagine the added logic would look like this (packages/mesh-core-cst/src/message-signing/check-signature.ts):

const builder = CoseSign1.fromCbor(signature); // line 9
// address check
if(address) {
    const headermap = builder.headers().protected().deserialized_headers();
    const addressHex = Buffer.from( headermap.header( Label.new_text("address") ).to_bytes() )
        .toString("hex")
        .substring(4);
    const derivedAddress = Address.from_bytes( Buffer.from(addressHex, "hex") );
    if(address !== derivedAddress) return false;
}
// end address check

Do we already have a way to get the headermap from the signature? If so then we just have to add that line to the checkSignature function.

Thanks for your hard work on MeshJS, it really is appreciated. You made development on Cardano a lot easier for me.

[JustLeif]

This PR could be what you're looking for: https://github.com/MeshJS/mesh/pull/387#issue-2658743090